Add a CONTRIBUTING file.
-------------
Created by MOE: http://code.google.com/p/moe-java
MOE_MIGRATED_REVID=80619149
Modify the dynamic allow origin test to be closer to real-world exploitable conditions: seldom the variability of an Origin is a problem on an unauthenticated response.
There is the occasional issue with IP based filter in a LAN network, but this is a different scenario that is very hard to replicate properly with the firing range (ideas welcome).

The dynamicalloworigin servlet will now return a Access-Control-Allow-Credentials=true header on all responses. This is not a perfect replacement for requiring authentication (e.g. returning a different response on cookies set or not) but it's a reasonable middle ground. Suggestions welcome on this too.
-------------
Created by MOE: http://code.google.com/p/moe-java
MOE_MIGRATED_REVID=82245613
Modify the remote source test so that it cannot be exploited via standard XSS (parameter escape).
This helps focusing the test.
-------------
Created by MOE: http://code.google.com/p/moe-java
MOE_MIGRATED_REVID=82499957